About CLIq

CLIq · ‎10-10-2020

I am trying to set up a TLSv1.3 / TLSv1.2 webserver behind a palo firewall with ssl inbound decryption. However i seem to get a lot of ssl errors and the website does not work if specific ciphers are not listed first... For one I would like to understand why that is and even ciphers listed here have issues: https://docs.paloaltonetworks.com/compatibility-matrix/supported-cipher-suites/cipher-suites-supported-in-pan-os-10-0/cipher-suites-supported-in-pan-os-10-0-decryption.html#id11638f8b-8bc0-4189-800d-43f1567339b6 Basically, what should the apache config look like for the palo to be able to decrypt the traffic, yet still have the highest possible security (e.g. as rated by https://www.ssllabs.com/ssltest/) ?

CLIq · ‎03-02-2020

as a further response... seems the panorama has not been designed for such a use-case as without a valid license you cannot even enter most of the configuration... was hoping that the licensing could be taken care of manually after the "automatic config restore"

CLIq · ‎02-08-2020

@reaper i dont need the gui but a network connection for this Thanks, I wanted to see if there was any possibility as I doubt the feature request will be taken into consideration as this is not meant for production... anyways, will try. Thanks

CLIq · ‎02-08-2020

@reaper Thanks but like I mentioned above, I need to do this without GUI and without network connections. I can script it and I have access to the hypervisor and console of the Panorama. so far the only option I see is to use the export as set commands (although i am not sure if a "show" will give you the complete panorama config as it does not if its in xml format) and then restore it the same way by entering those set commands... unfortunately the login prompt is **bleep**... so difficult to login with a script as you cannot know when the authdaemon is started. any comments anyone? better idea? confirm any part of my hypothesis?

CLIq · ‎02-08-2020

@reaper yes, that does not seem to show the complete configuration and cannot be used to restore panorama with a file. anyways it seems that panorama does not support something like bootstrapping... so basically I guess I am asking what the best way would be to automate backup and restore of panorama... i was thinking about using set commands but then there is the problem of not being able to detect when you are able to login... if I script it and it keeps saying invalid credentials... i cant differentiate that from actually not being able to login... has anyone even ever tried that and will the "show" with set commands actually restore the complete panorama configuration if entered on a "fresh" panorama?

CLIq · ‎02-07-2020

Thanks @jdelio but that doesnt help me unfortunately, seems more like its not possible although i dont understand why panorama does not have the same command to output the config in xml format...

CLIq · ‎02-06-2020

yes but that doesnt work for me... I need a solution via console or rather without network connectivity. This is not for a production system, its for a lab software For the firewall I save the output from the console in a file and automate the bootstrapping so you can easily backup/restore configs in seconds, works well so far actually (I tried to do it with saving and restoring the set commands but trying to automate the login is a pain for several reasons, 1.) password after 9.0.4 cannot be admin/admin anymore 2.) console keeps telling you incorrect login and there is no consistent way of telling when thats true or if the authentication daemon still needs time to start

CLIq · ‎02-06-2020

Hi, I would like to backup and restore a panorama like I can with the firewall, on the firewall i set "set cli op-command-xml-output on" and get the config via the console, then bootstrap the firewall to restore the config... now i am wondering how I can do the same with panorama... it seems that i can neither set operational output to xml, nor restore a config via bootstrap... is that so? is there any way i could automate backing up a panorama and restoring it?

CLIq · ‎02-05-2020

@kiwi I am looking for the same thing just on panorama, does something exist for this on panorama as well?

CLIq · ‎01-27-2020

@dgildelaig i am new to expedition, thanks for taking the time to answer me. I did have to "Change Settings" on the project and add the firewall to the project, thanks for the tip!

CLIq · ‎01-26-2020

Hi, I have added a vm-series firewall to the devices and it can download some contents (application-container,applications,regions,and custom: configbackup.xml.dat,url_categories.xml) but configuration, licenses and system-info is not downloaded. No error appears when i retrieve the contents. When I go to the M.Learning tab the only traffic-log file from yesterday cannot be processed. I created a new project and tried to import the device but it is not listed! Expedition version 1.1.52.1 Spark Dependencies 0.1.3-h2 Best Practices 3.21.3

CLIq · ‎01-24-2020

ok, i assume this is a bug with all images then and will open a support case 🙂

CLIq · ‎01-21-2020

@OtakarKlier its a fresh kvm image, so yes. bootstrap works fine but no messages appear even if i try to cause it by e.g. not putting values inside init-cfg or missing folders, etc. i simpy get no console logs from bootstrap, no matter if successful or not... i would like to monitor the console to confirm a successful bootstrap EDIT: to be clear, I dont have issues with the actual bootstrap process, i got that to work but I would like to verify console logs to make sure it was successful (automatic checks from the console during boot)

CLIq · ‎01-21-2020

thanks @kiwi

CLIq · ‎01-20-2020

How does one change their displayname here?

Member Since	‎09-17-2019 05:25 AM
Date Last Visited
Posts	35
Total Likes Received	13

About CLIq

Re: Commit error After PANOS10.1.10 upgrade

Re: LSVPN not working when NAtted via Loopback

Re: LSVPN not working when NAtted via Loopback

Re: Inbound SSL decryption for apache2 server

Re: LetsEncrypt integration

Re: Decrypt-error with Inbound Decryption DHE or ECDHE on 8.1.3

Re: When should I use "enforce symmetric return" in the PBF rules?

Re: LetsEncrypt integration

Re: SNI for GlobalProtect

Re: Inbound SSL decryption for apache2 server

Change display name in live community

Re: Commit error After PANOS10.1.10 upgrade

Re: When should I use "enforce symmetric return" in the PBF rules?

Re: LSVPN not working when NAtted via Loopback

Re: Inbound SSL decryption for apache2 server

Inbound SSL decryption

Re: Panorama: config output on CLI

Re: Panorama: config output on CLI

Re: Panorama: config output on CLI

Re: Panorama: config output on CLI

Re: Panorama: config output on CLI

Re: Panorama: config output on CLI

Panorama: config output on CLI

Re: How to set CLI output in Operational mode

Re: Machine-Learning -> FW does not appear under import devices and processing of traffic log fai

Machine-Learning -> FW does not appear under import devices and processing of traffic log fails

Re: Bootstrap debugs / logs

Re: Bootstrap debugs / logs

Re: Change display name in live community

Change display name in live community

Nebula Beta

Okta Cloud Directory Beta

Seattle Beta

Unlock your full community experience!

About CLIq